CVE-2026-40557 Apache Storm证书验证绕过漏洞

import javax.net.ssl.*; import java.io.IOException; import java.net.URL; import java.security.KeyManagementException; import java.security.NoSuchAlgorithmException; import java.security.cert.X509Certificate; // PoC simulating the vulnerable behavior in Apache Storm PrometheusPreparableReporter public class VulnerableSSLContext { public static void main(String[] args) throws NoSuchAlgorithmException, KeyManagementException, IOException { System.out.println("[+] Simulating CVE-2026-40557: Global SSL Context Downgrade"); // 1. Create an insecure TrustManager (matches INSECURE_TRUST_MANAGER) TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() { public X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted(X509Certificate[] certs, String authType) { /* Empty/Vulnerable */ } public void checkServerTrusted(X509Certificate[] certs, String authType) { /* Empty/Vulnerable */ } } }; // 2. Initialize SSLContext SSLContext sslContext = SSLContext.getInstance("TLS"); sslContext.init(null, trustAllCerts, new java.security.SecureRandom()); // 3. VULNERABLE OPERATION: Setting the global default SSLContext // This is what PrometheusPreparableReporter does when skip_tls_validation is true SSLContext.setDefault(sslContext); System.out.println("[!] Global SSLContext has been set to INSECURE mode."); // 4. Proof of Concept: Opening a connection to any HTTPS site will now ignore certificate validation // (Simulating subsequent connections to ZooKeeper, Thrift, etc.) URL url = new URL("https://expired.badssl.com/"); // A site with invalid cert HttpsURLConnection conn = (HttpsURLConnection) url.openConnection(); conn.setRequestMethod("GET"); try { conn.connect(); System.out.println("[+] Connection successful! Certificate validation was bypassed globally."); System.out.println("[+] Response Code: " + conn.getResponseCode()); } catch (Exception e) { System.out.println("[-] Connection failed (should not happen if vulnerable)."); } } }